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We consider the possibilities offered by Gaussian states and operations for two honest parties, 
Alice and Bob, to obtain privacy against a third eavesdropping party, Eve. We first extend the 
security analysis of the protocol proposed in M. Navascues et ai., Phys. Rev. Lett. 94, 010502 
(2005). Then, we prove that a generalized version of this protocol does not allow to distill a secret 
key out of bound entangled Gaussian states. 



PACS numbers: 03.67.Dd, 03.65.Ud, 03.67.-a 



in 
o 
o 

(N 



> : 
o . 

o ■ 
(N : 
o . 
in ■ 
o ; 

^ ■ 

a,: 

^— > ■ 
c ■ 

s : 
cr 



X 



I. INTRODUCTION 



The study of those tasks that can be achieved by pro- 
cessing information encoded on quantum states is the 
main scope of Quantum Information Theory (QIT). The 
basic unit for quantum information is the so-called quan- 
tum bit, or qubit, namely a two-dimensional quantum 
system. Moreover, quantum correlations, or entangle- 
ment, constitute a key resource in QIT, their unit be- 
ing the entangled bit or ebit. In general, any (quantum) 
information task can be seen as an inter-conversion of 
resources. For instance, quantum teleportation [l| can 
be summarized as the process transforming 1 ebit + 2 
bits — * 1 qubit, while dense coding corresponds to 
the transformation 1 ebit + 1 qubit — * 2 bits. Moving 
to cryptography, secret bits are a fundamental resource. 
These are perfectly correlated and random bits shared by 
two honest parties, Alice and Bob, about which a third 
dishonest party, Eve, has no information. Any quantum 
key distribution protocol can be seen as the process of 
distributing secret bits through an insecure channel by 
means of quantum states. Therefore, relevant questions 
in this context are to identify those quantum states con- 
taining secret correlations and show how to distill these 
correlations into a perfect secret key. Indeed, it has re- 
cently been shown that a quantum state contains secret 
correlations if and only if it is entangled |j| ■ 

In these last years, Quantum Information Theory for 
Continuous Variables systems has proved to be a very 
fruitful area, as it allows theory to connect easily with ex- 
periments (for a review, see Q). In this case, the informa- 
tion encoding is done on continuous quantum variables, 
such as the quadratures of the electromagnetic field. Re- 
cent works have been developed in the aim of reproduc- 
ing well-known Quantum Information protocols for finite- 
dimensional systems in this new setup. Examples of these 
are quantum cryptography [j| or quantum teleportation 
Interestingly, most of these protocols work using 
only Gaussian operations, i.e., operations that transform 
Gaussian states into Gaussian states. This is important 
because Gaussian operations are easy to implement ex- 
perimentally with high accuracy level. A beam splitter 
or a squeezer are examples of Gaussian operations, while 
photon counting constitutes a non-Gaussian operation. 



Up to now, non-Gaussian operations are challenging from 
an experimental point of view (see however |2j). 

A significant effort has been devoted to study the pos- 
sibilities and limitations Gaussian Operations provide to 
Quantum Information protocols. We know, for example, 
that entanglement distillation of Gaussian states with 
Gaussian operations is impossible 0, 0, El • More pre- 
cisely: although there exist entangled Gaussian states 
that are distillable to singlets, the distillation process re- 
quires a non-Gaussian operation. Or, in other words, 
the process of converting Gaussian quantum states into 
perfect ebits by means of Gaussian local operations and 
classical communication (GLOCC) is impossible. How- 
ever, ebits is not the only information resource two col- 
laborating parties may want to establish through quan- 
tum states. Actually, distillation of perfect secret bits 
by GLOCC is known to be possible from some Gaussian 
states 0- Thus, the set of Gaussian states and opera- 
tions can sometimes be sufficient for cryptographic ap- 
plications. At first sight, this result may seem surprising 
taking into account that Gaussian states have a positive 
Wigner function, i.e., there is a local variable model that 
reproduces the correlations given by Gaussian measure- 
ments. 

In this article, we analyze the process of extracting se- 
cret bits from several copies of a given Gaussian state 
when the honest parties are allowed to perform local 
Gaussian operations and communicate classically. In the 
derivation of all the results, it is assumed that Alice and 
Bob share N independent copies of a known Gaussian 
state. That is, we do not consider the important prob- 
lem of the distribution and estimation of these states. 
They simply constitute an initially given resource that 
the honest parties will to convert into secret bits. We 
start reviewing the results of where it was shown 
that, provided Eve is restricted to individual attacks, a 
secret key can be extracted from any entanglement dis- 
tillable state. We extend the security analysis of this 
protocol for the case of collective attacks, giving a nec- 
essary and sufficient condition for secret key distillation. 
We also show that there is no way in which the honest 
parties can attain privacy with our protocol if the ini- 
tial state is bound entangled. This is true even if Eve is 
assumed to measure her state before any reconciliation 
process has taken place. This suggests that Gaussian op- 
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erations may be useless to extract a secret key out of 
bound entangled Gaussian states, in opposition to the 
astounding results in ^3] for finite-dimensional systems. 

The article is organized as follows: Section [n] is a brief 
introduction to the Gaussian states and Gaussian oper- 
ations formalism. The reader familiar with both topics 
can skip this part. In Section llll| we analyze the limits 
of the protocol introduced in 11]. In particular, we show 
that it allows to prove the security of sufficiently entan- 
gled states, while it fails for any bound entangled state. 
Section Hvl is devoted to our conclusions. 



II. GAUSSIAN STATES AND OPERATIONS 

In this article we consider quantum systems of n 
canonical degrees of freedom, called modes, belonging 
to B(H(M. n )). These are characterized by operators 
(X 1 ,P 1 ,..,,X n ,P n ) = (Ri,..,,R 2n ) satisfying the com- 
mutation relations [Rj,Rj] — i(cr n )jk, where 



1 
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(1) 



is called the symplectic matrix. In this context, it can be 
proved that any operator A transforming n-mode states 
to n-mode states can be expressed as 



A = (2tt) 



(2) 



where xa(0 is the so called characteristic function and 
W% are the Weyl operators, defined as 



(3) 



and R = {Ri...Rz n ). Weyl operators satisfy the well- 
known Weyl relations 



(4) 



When A corresponds to the density operator associated 
to a certain state, Xa(£.) is called the characteristic func- 
tion of the state A. One can also define the Wigner func- 
tion HU(£) °f A as 



Wa(£) = (2tt)- 2 " / e^ X A(v)d 2n V 



(5) 



The Wigner function behaves as a quasi probability dis- 
tribution in phase space. It is normalized, and integrat- 
ing over Xi or Pi for each mode gives the corresponding- 
probability distribution of the remaining canonical vari- 
ables. 

For every state p, one can define its displacement vec- 
tor d as dk = tr{pRk} and its covariance matrix 7 as 
Iki = tr{p{R k - dk,Ri - di} + }, where {}+ denotes the 
anti-commutator. Because of the Heisenberg uncertainty 
relations, any state has to satisfy 



Gaussian states are those n-mode quantum states 
whose characteristic function is of the form: 



x(0 



(7) 



Thus, any Gaussian state is completely described by its 
displacement vector d and covariance matrix 7. 

Gaussian operations are completely positive maps 
transforming Gaussian states into Gaussian states. 
Gaussian operations were fully characterized in 0, . 
There, the authors show that a Gaussian state G with 
covariance matrix T and displacement A can be associ- 
ated to each Gaussian operation Q. In particular, if T 
and A are given by 



(8) 



then the application of Q on a Gaussian state (7, d) pro- 
duces a Gaussian state (7', d') such that 
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d' = A! + r 12 ^ (A 2 + d), 

r 2 + 7 



(9) 



where T = (1 <S 9)T(1 8 0) and 9 = D(l, -1, 1,-1...) 
is the transformation that changes the sign of the mo- 
menta. Throughout this article, D(a, b, . . .) will denote a 
diagonal matrix with non-zero entries a, b and so on. 

A fundamental Gaussian operation is homodyne de- 
tection, that is, the physical measurement of one of the 
canonical coordinates. Let 7 define a Gaussian state with 
zero displacement vector. Suppose 7 can be divided into 
modes as 



1 



A C 
C T B 



(10) 



If we measure the X component of each of the modes cor- 
responding to A, obtaining the result (Xi, JT 2 , ...), system 
B will turn into a Gaussian state with covariance matrix 
i 



B 1 = B — C (XAX) MF C 
and displacement vector 

d B = C T (XAX) MP d A , 



(11) 



(12) 



where d A — (-^1,0,^,0...), MP denotes the pseudo- 
inverse (inverse on the range) and X is the projector 
X = D(l, 0,1, 0,1,0...). 

Another important subset of Gaussian operations is 
constituted by the so-called symplectic transformations. 
It can be proved that unitary Gaussian operations are 
the ones that transform the canonical coordinates in the 
following way: 



7 > ia. 



(6) 



R! = SR + T, 



(13) 
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where T is a vector and S is a matrix belonging to the 
symplectic group Sp (2n,lZ). The symplectic group is 
given by those matrices leaving invariant the symplectic 
matrix, i.e. satisfying S(tS t = a. When T = 0, the 
transformation is called symplectic. Under symplectic 
transformations, the displacement vector and the covari- 
ance matrix change into d! = Sd and 7' = SiS T . Sym- 
plectic transformations are very relevant because of the 
following 

Theorem (Williamson) [l3|: For any real and posi- 
tive definite 2n x 2n matrix, C, one can find a symplectic 
matrix S such that 

SCS T =0? =1 A i l 2 , (14) 

where Ai > are called the symplectic eigenvalues of C. 

Because of ©, if we apply this theorem to the co- 
variance matrix of a certain state, we will get that all 
its symplectic eigenvalues A, have to be greater or equal 
than one. Moreover, for a Gaussian state with covariance 
matrix 7, the identity tr(p 2 ) = det(7) -1 / 2 holds (recall 
that tr(p 2 ) gives a measure of the purity of p). So, a 
Gaussian state is pure if and only if all its symplectic 
eigenvalues are equal to one. 

Finally, let us give some known results about entangle- 
ment and Gaussian states that will next be used. In this 
case, one considers Gaussian states in bipartite systems 
of n + to modes, where Alice and Bob's systems are of n 
and to modes , res pectively. 

Theorem |14|: Let ^ab be the covariance matrix of 
a Gaussian state in a bipartite system. This state is 
separable if and only if 

IAB > la © lb, (15) 

for certain physical covariance matrices i a and 75 in sys- 
tems A and B, respectively. 

Partial transposition is a positive, but not completely 
positive, map that plays a key role in entanglement the- 
ory. In the case of continuous variable systems, after 
partial transposition on, say, system B, the sign of Bob's 
momenta is changed while the rest of canonical coordi- 
nates is kept unchanged. At the level of covariance matri- 
ces, this means that iab — * i'ab = @b!ab9b- Therefore, 
a state p has non-positive partial transposition (NPPT) 
when i'ab does not define a positive operator, that is 

IAB t iv, (16) 

where a = (1a ffi #b)c(1a © Ob)- It can be shown that 
this condition is equivalent to 

IAB t °l A B dT - ( 17 ) 

The positivity of partial transposition, also known as 
PPT criterion, represents a necessary and sufficient con- 
dition for separability for lxl 0] and 1 x N Gaussian 
states while it is only a necessary condition for the 
rest of systems Q. It also gives a necessary and suf- 
ficient condition for entanglement distillability: a Gaus- 
sian state is distillable if and only if it is NPPT . 



III. SECRET BITS FROM GAUSSIAN STATES 

In our quantum cryptographic scenario, there are two 
parties, Alice and Bob, who share several copies of a cer- 
tain Gaussian state, pab- As said, it is assumed that 
the honest parties know to have N independent copies 
of pab- There is also an eavesdropper, Eve, that keeps 
the purification of that state. In a prepare and measure 
scheme, the assumption in the state preparation means 
that Eve interacts identically, individually and in a Gaus- 
sian way with the states sent to Bob by Alice. Alice and 
Bob perform some individual measurements over their 
copies and afterwards apply Advantage Distillation, Er- 
ror Correction and Privacy Amplification techniques to 
extract a perfect secret key. These three processes con- 
stitute the reconciliation part of the protocol. We con- 
sider two type of attacks: (i) individual, where Eve per- 
forms individual measurements, possibly non-Gaussian, 
over her set of states before Alice and Bob's public rec- 
onciliation, or (ii) collective, where Eve waits until the 
reconciliation is finished and then decides what (possibly 
collective) measurement gives her more information on 
the final key. Note that this second type of attacks is 
the most general under the mentioned assumption in the 
state preparation. On the other hand, to assume that 
Eve measures her state before the reconciliation process, 
as for individual attacks, appears quite reasonable from 
an experimental point of view. 

In this section, we first review the protocol described in 
[Tlj . There, it was proved that (i) a secret key can be dis- 
tilled from any NPPT Gaussian state, provided that Eve 
is restricted to individual attacks, (ii) there exist slightly 
entangled states that become insecure, with our protocol, 
when Eve's attack is collective and (iii) key distillation 
secure against collective attacks is still possible for suffi- 
ciently entangled states. Here, we will first improve the 
security analysis against collective attacks, giving a nec- 
essary and sufficient condition for secret key distillation 
from Gaussian states with our protocol. Later, we will 
show that our scheme does not allow to extract a secret 
key out of bound entangled Gaussian states. 

A. Key distillation protocol 

The key distillation protocol presented in ^l| consists 
of the following steps: 

1. Starting from pab, Alice and Bob apply the 

GLOCC protocol of HU mapping any NPPT Gaus- 
sian state of n+m modes into an NPPT lxl Gaus- 
sian and symmetric state, whose CM, see Eq. ijTUjl. 
is 

*-»- (of) "-(U). M 

where A > and c x > c p > 0. The positivity 
condition reads A 2 — c x c p — 1 > X(c x — c p ) while the 
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entanglement (NPPT) condition gives 

A 2 +c x c p - 1< \{c x +c p ). (19) 

2. Each of them measure the X quadratures of their 
modes, Xa,Xb- As soon as all measurements are 
done, Alice randomly chooses a real number Xq > 
and sends it to Bob via a classical channel. If their 
measured quadratures satisfy \X^\ = \X B \ = X , 
they accept the results. Otherwise, they discard 
them. They then make binary these results accord- 
ing to the prescription Xi = Xq — ► 0, Xj = — Xq — > 
l,i = A, B, thus obtaining a list of correlated bits. 

3. Alice and Bob apply Classical Advantage Distil- 
lation ^3 over their lists of symbols: they ran- 
domly choose a set of N indices, and build bi- 
nary N- vectors with the corresponding symbols ap- 
pearing in their lists: {Ax, A 2 , An) for Alice 
and {Bx, Bjsr) for Bob. Then, Alice generates 
a random bit, c e {0,1}, and sends Bob a vec- 
tor (ci,...,cjv) such that A\ © c\ = A 2 © c 2 = 
... = An © = c. Next, Bob computes the 
quantities c[ — Bi © Cj, i — 1,...,N. In case 
c[ = c' 2 = ... = c' N = c' , Bob accepts the sym- 
bol c' . Otherwise, he discards it. Anyhow, after 
this step Alice and Bob will have to throw away all 
the symbols used and repeat the process with the 
remaining symbols. At the end, they will have a 
reduced list of more correlated symbols. 

4. Alice and Bob apply Error Correction and Privacy 
Amplification protocols to the new list in order to 
obtain a secret key. 

Let us denote by ujab Alice and Bob's lxl state after 
step 1 and by es the probability that Alice and Bob ob- 
tain different results (namely, (X ,— X ) or (— X ,X )) 
after the homodyne measurements and post-selection. 
Let us also denote by \e±±) Eve's resulting states when 
Alice and Bob measure (±A"o, ±A"o). If Eve is restricted 
to individual attacks, i.e. she measures before step 3, the 
honest parties can distill a key when frs| 



(b 



l-e B 



<|<e ++ |e__>|. 



(20) 



Actually, this security condition also holds for the case 
in which Eve applies a measurement on a finite number 
of copies of her states before the reconciliation process 
has started. As shown in Eq. I|20|) is equivalent to 
demand that the initial state pab was NPPT. 

Now, one would naturally wonder how this security 
condition has to be modified when Eve is allowed to 
perform a collective attack, i.e. she can measure after 
the public reconciliation. In this case, Eve's informa- 
tion during the whole protocol is quantum. Note that, 
once the honest parties accept a symbol after Advan- 
tage Distillation, they can agree to both change its sign 
or not. This is so because the symplectic transformation 



(X A , Pa, X b , P b ) -» {~X A , -P A , -X B ,-P B ) leaves the 
Gaussian state ujab invariant. Therefore, we can consider 
that Alice's N symbols employed in a successful perfor- 
mance of step 3 are equal, and so Bob's. That is, the 
global state resulting from step 3 is (see also [lj|) 

Pabe = — ^ ([00] ® [e ++ f N + [11] ® [e__]®") 



([01]® 



]® N + [10] ® [e_+]®") (21) 



where [ip] denotes the projector onto \ip) and 6bn is Bob's 
error probability after Advantage Distillation. For large 
N, this error has the form 0] 



€BN OC 



( B 



l-e B 



N 



(22) 



In step 4, Alice and Bob apply the one-way key dis- 
tillation protocol given in |2Cj. This protocol deals with 
the case where Alice has a classical random variable, A, 
correlated to a quantum state on Bob and Eve's hands, 
Pb\a an d Pe\a- The achievable key rate satisfies pfj| 



> X {A : B) ~ X (A : E) 



(23) 



where \{X : Y) denotes the Holevo bound [2l|, i.e., 
X {X : Y) = S(p Y ) - J2 x p(X)S(p Ylx ) and p Y = 
J2xP (X)py\x- In our case, Alice and Bob have classi- 
cal variables, so x(A ■ B) is actually equal to the mutual 
information I {A : B), which is a function of £bn- Let us 
compute in what follows x(^4 : E). 

Notice that in the limit of large N, the error terms in 
(|2T|) can be neglected, since £bn — ► 0. This means that 
the states pe\a are actually pure, so %(A : E) sw S{pe) 
for large N. If the covariance matrix associated to the 
state ujab is given by 



1AB 



lx R 
R T S 



(24) 



where j x , R, T and S are 2x2 matrices, one can see that 
for large N, S(pe) oc kg, where 



logk E = -{X ,Xo)(S-R t j- 1 R-'y- 1 ) 



X 
X 



(25) 



Actually, one has that S — R T j~ 1 R — 7" 1 = 
{(o~1ab cjT )x}~ 1 ~ Ix 1 - Throughout this article, {M) x 
denotes the projection of a generic operator M onto 
the x space. It follows from this expression that fog = 



1^ 



Comparing now the two quantities, it is 



clear that a positive key rate is possible when 



(B 



1-es 



(26) 



This gives a sufficient condition for distilling a secret key. 
On the other hand, if Eve applies the particular attack 
proposed in [2^, our protocol turns out to be insecure 
if Eq. (H)J) does not hold [13 • That is, Eq. is 
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FIG. 1: Security analysis of isometric lxl Gaussian states, 
with covariance matrix satisfying, see Eq. 11811 . c x — c p = c. 
All physical states are above the solid line. The dashed line 
defines the entanglement limit, that coincides with the se- 
curity bound against incoherent attacks. States below the 
dashed-dotted line are secure against any attack. It is implic- 
itly assumed that Alice and Bob measure the X quadratures. 



indeed the necessary and sufficient condition for positive 
key extraction using our GLOCC protocol from Gaussian 
states. Therefore, this closes the security gap left open 
in the analysis of (see also Fig. 1). 

This result could somehow be expected: the applica- 
tion of the projectors [±-Xo] transforms the original Gaus- 
sian state into an effective 2-qubit state that tends to a 
Bell diagonal state in the limit A?" going to infinite. The 
necessary and sufficient for positive key extraction from 
a two-qubit state has recently been derived in [l9|. The 
bound given there looks identical to (|26[) . 



B. Bound entangled states 

Our next result concerns the distillation of secret bits 
from PPT Gaussian states using the previous GLOCC 
protocol. Recall that in the Gaussian scenario, a state is 
entanglement distillable if and only if it is NPPT. This 
means that there do not exist NPPT bound entangled 
states. It is quite clear that the considered protocol, in 
the form previously presented, does not allow to extract 
a secret key from any PPT state. Indeed, in step 1 any 
PPT state is mapped into a 1 x 1 PPT state, which is sep- 
arable [l^ , and no secret key can be extracted from sep- 
arable states [23j. This is why we consider a generalized 
version of the protocol above, where step 1 is replaced by: 
1.' Alice and Bob perform any GLOCC pre-processing, 
possibly non-deterministic, over their states. Then, they 
measure the X quadrature of one of their modes as in 
step 2 and the protocol proceeds as explained above. It 
is next shown that even in this more general scenario 
and restricting Eve to an individual attack, no secret key 
distillation is possible from PPT states. 

As above, eb defines Bob's error probability after ho- 



modyne measurement and postselection. Let p+ and p_ 
be Eve's resulting states when Alice and Bob measure 
(Xo,Xq) or (— X ,— Xq), respectively. Contrary to the 
previous situation, these states can now be mixed. Then, 
if Eve is restricted to individual attacks, a secret key can 
be distilled using our scheme if and only if 



< tr i 



(27) 



It is possible to derive this formula from 0. There, it 
is shown that Eve's error probability behaves as een °c 
(Ei^i \/ti(p + Mi)tT(p-Mi)) N , where M, is the i th oper- 
ator corresponding to the i th outcome of Eve's measure- 
ment, 'Yin Mi = 1. Now, one has to take into account 
that the minimum of ^\ \Ztr(p + Mi)tr(p-Mi)) over all 
possible measurements is equal to the Uhlmann's fidelity 
|24| of p+ and p_, namely tr(y / ^/p = p+^ 



/p~). A deriva- 
tion of this result can be found in |25(. Recall that Bob's 
error probability after step 3 goes as (|22l) . Thus, for Alice 
and Bob to extract a secret key it is enough that ebn de- 
creases exponentially faster than een- Then, condition 
(|27|l immediately applies. 

Our goal is now to express (|27|l in terms of 7,45 • In 
fact, it will be seen that l|27|l is equivalent to the NPPT 
condition for Gaussian states. 

As usual, it is supposed that Eve's state is entangled 
with Alice and Bob's one, so that the whole state is pure. 
Let's assume that Alice and Bob have just finished the 

(r) 

GLOCC pre-processing of step 1 , and let's call j AB the 
resulting reduced covariance matrix that contains only 
their first modes. We introduce the following notation: 



1ABE 



(r) 
Tab 



Tab 



L E 
E T G T 



F 



IE/ 



'7* R 

R T S 



(7&)" 1 = 



X Y 
Y T Z 



(28) 



where j x and X correspond to the X a- Xb space. The 
following formula will next be useful 26] : 



A C 
C T B 



(A-C^C 7 )- 1 A~ X C(C T \C — B)~ r ) 



(C T \C - B)- X )C T A- 1 (B-CT^C)- 1 



(29) 



Using equations (|ll|l and i|12|) . it is straightforward to 
check that p + is described by: 



i E - lE -E T f3E 
fX \ 

d' = E T P 




(30) 



6 



where 



= 



lx 1 




(31) 



Similarly, if Alice and Bob measure — Xq, Eve's corre- 
sponding state p- will have the same covariance matrix 
and opposite displacement vector. 

Let us first calculate the right hand side of (|27|) . It can 
be shown (see Appendix A) that 



tr (\/ \fp~P+\fp~) = e 



-dEl E 1 d' E 



(32) 



Now we want to write this in terms of Jab- If we define 



E = 



E x 
E„ 



(33) 



where E x is the part of E corresponding to the X quadra- 
tures, we only have to substitute to get that d E r ^ E 1 d' E 
can be written as 



( X Q X Q ) j-'E^e - E^-'E^E^- 1 ( *° ) 



Using formula (|29[) applied to the matrix 

-l 



K = 



lx Ex 
E T X IE 



(34) 



(35) 



and the condition KK 1 = 1, we have that E X (^ B — 
E^- x E x )- x Ely x = lx ( lx - E^ElY 1 - 1. Sub- 
stituting, we arrive at 



d 'IlE ld E 



( X Q X ) (( 7:c - E xlE X El^ - 7 -i) ( *° ) . 



(36) 



Note that ( / y x —E x r y E E'£) is just the projection of (~/ab — 
Fj e 1 F t ) onto the x space. Therefore, one can replace 
in the previous expression {^ x — E^^E^) and 7- 1 by 
(jab - F lE 1 F T ) x and (j^ B ) x . 

On the other hand, we have assumed that Eve purifies 
the state shared by Alice and Bob. Since all purifications 
are equivalent up to a unitary transformation on Eve's 
space, one can consider a particular purification without 
loosing generality. One possible purification, see l|28l) . is 
given by H3 

F = a AB [-{a A BlAB? - t] 1/2 lE = e lAB e. (37) 

If S is the symplectic matrix such that S t jabS is diag- 
onal, one can verify that 

F 7b 1 F t = -OABS(® k J\l - ll 2 )5- 1 5(© fc -^-l2) 

v Afe 

S T {S- 1 ) T {® kS J\l - lt 2 )S T CJAB 

X 2 — 1 

= -<TABS(® k —, t 2 )S T a AB 



1AB - ^ABl A B a AB- 



(38) 



So 7ab - F^eF 1 = a^ AB a T and tr( v / 1 ^fpZp+^fpZ) i 



equal to 
exp 



X 2 ( 1 1 ) {{vabIaWab). 1 - (iab)- 1 ) ( } 



(39) 

The next step is to calculate the left hand side of lt2"7l) . 

Let p(Xa, Xb) be the probability density of (Xa, X b ), 
the X quadratures of the reduced state . The corre- 
sponding Wigner function satisfies: 



w(£) cx e 



If £ = ,xf ,p), then, according to (|28p. 



(40) 



= J e -(S T Xx+2x T Yp+-fZp) d ^_ ^ 

Finally, we get 

p(xtxf)o,e- sT ^ x - YZ " YT ^. (42) 

But, looking at (J2HJ, we see that this is just 
cxp(— x T/ -f~ 1 x). Writing 



lx 



a b 
b c 



it is easy to see that, in our protocol, 



= exp 



46A 2 



1 — e B \ ac — b 2 

In a similar way, one can define 

i^AB aT h = ( e / 



(43) 



(44) 



(45) 



and then, the term in the exponent of Eq. (|39|l can be 

expressed as 



2 d-2e + f a-2b + c^ 



de-p 



b 2 



(46) 



Collecting all these results, the condition Ij27(l for dis- 
tilling a key with this protocol is equivalent to 



d + f - 2e a + c + 2b 



df-e 2 



b 2 



< 0. 



(47) 



We are now in a position to prove the next 

Theorem: A secret key secure against individual at- 
tacks can be distilled with our GLOCC protocol from a 
Gaussian state if and only if the state is NPPT. 

Proof: The idea of the proof is to show that condition 
(|27J) is equivalent to the PPT criterion. First, note that 
Eq. H47f) can be rewritten as 



(1 -l)((^7^ T )^-7.- 1 )(_ 1 1 ) <0 



(48) 
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Since (S'"/ AB a T ) x and ^ x are positive operators, the pre- 
vious equation implies that ^ab — ^1ab^ T ~i- 0- But 
this is the condition for a Gaussian state to be NPPT, 
as stated in (|17|l . Therefore, if a key can be distilled out 
of a Gaussian state with the previous protocol, this state 
has to be NPPT. For the opposite implication one sim- 
ply has to apply the protocol of [Tl|, that has previously 
been described. 



IV. CONCLUSIONS 

In this article, we have analyzed the extraction of secret 
bits from quantum states in the every-day-growing field 
of Quantum Information Theory with Continuous Vari- 
ables. We have first reviewed the protocol and results of 
[Tl|: a secret key can be distilled from any NPPT state 
when Eve is restricted to individual attacks. In the more 
general scenario of collective attacks, we extend the anal- 
ysis of |Tlj , providing a necessary and sufficient condition 
for key distillability, with the considered protocol. This 
protocol turns out to be completely useless for bound 
entangled states, even in the case of individual attacks. 
Before concluding, we would like to discuss several open 
questions and implications that follow from our results. 

First, note that all the presented results aim at answer- 
ing whether secret bits can be extracted from Gaussian 
states by GLOCC. In terms of resources, we study the 
conversion of Gaussian states into secret bits. However, 
very little is said about the rate governing this conver- 
sion. This problem appears as a natural follow-up of the 
present work. Notice that, strictly speaking, the consid- 
ered key-distillation protocol has zero rate. Indeed, the 
probability that Alice and Bob obtain the outcomes ±Xo 
is zero. Of course, the analysis can easily be adapted to 
a protocol with finite rate: Alice and Bob only have to 
accept outcomes in the range |Ao ± S\, where 5 > 0. 
By choosing a properly small 5, the security conditions 
still hold because of continuity, while the protocol auto- 
matically acquires a finite rate. It is intriguing the fact 
that both security conditions, Eqs. (121 III and l|26|) . are 
independent of X . This suggests that key distillation 
should still be possible when Alice and Bob directly as- 
sign a bit to the sign of their measurements, without 
discarding any value. This would represent a significant 
improvement of the final key-rate. Unfortunately, this 
result remains unproven. It would also be desirable to 
adapt the reconciliation process to the continuous char- 
acter of the measured quantity, in a similar way as the 
sliced-reconciliation protocols for error correction intro- 
duced in psj . 

Another related question is the distribution of quan- 
tum states. All our results were based on the hypothesis 
that Alice and Bob share N independent realization of 
the same known Gaussian state. However, in any practi- 
cal cryptographic protocol, Alice and Bob will send and 
measure quantum states through an insecure channel. 
From the observed probabilities, they have to infer what 



their correlations with the environment are. This is in- 
deed a very delicate process that has not been considered 
here. For instance, the honest parties cannot in principle 
exclude the existence of correlations between the differ- 
ent quantum systems they measure. While in our case, 
we simply assume that N copies of the same Gaussian 
state were given as an initial resource. 

At a more fundamental level, our analysis represents 
one of the first steps in the identification of the set of 
Gaussian states that can be converted into secret bits 
by GLOCC. As discussed in |Tj, for any Gaussian state 
one can define GKd and GEd, quantities that specify 
the amount of secret and entangled bits extractable from 
it by GLOCC protocols. The results of Refs. H ©, EH 
imply that GEo = 0. On the other hand, it follows 
from and this work that GKu is non-zero for suf- 
ficiently entangled NPPT states. It would be relevant 
to extend the present results, proving that GKo > 
for some states violating our security conditions. An al- 
most unexplored possibility in this direction is the use of 
global, but still Gaussian, operations by Alice and Bob. 
In particular, note that in the analyzed protocol, all the 
quantum operations were at the single-copy level. There- 
fore, it is unknown whether the use of coherent quantum 
operations gives any improvement for key extraction. A 
related open question is the existence of the so-called "en- 
tanglement purification" protocols [8|, where Alice and 
Bob map many copies of a noisy entangled state into 
a pure entangled state (not necessarily maximally en- 
tangled). The goal would then be to decouple the hon- 
est parties' correlation from the eavesdropper, something 
that it is sufficient in a cryptographic scenario. 

The case of bound entangled states is also of particu- 
lar interest. Indeed, our result suggest that GKjy = for 
all these states (c.f. ^2)- I* 1 the same spirit as in Ref. 
|12|. one could look for Gaussian secret states. These 
would be states for which there exist Gaussian measure- 
ments by Alice and Bob almost perfectly correlated about 
which Eve has arbitrarily small information. The results 
of section IIII Bl rule out this possibility for PPT states. 
Indeed, if this were the case, there would be PPT secret 
states. This would imply that our protocol would work 
for a PPT state, which has been shown here to be im- 
possible. Unfortunately, this does not allow to conclude 
that GKu — for PPT states. More in general, it would 
also be interesting to prove that Kd > for a Gaussian 
PPT state, i.e., that key extraction is possible, even if the 
distillation protocol employs a non-Gaussian operation. 
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APPENDIX: PROOF OF RELATION (l32ll 

From the definition of the characteristic function and 
relation J3J) it can be derived that 

p\ _> x f")(£) = e-^W^C^)^/^). (49) 
Therefore, 

(50) 

and then 

VpTpoVpI- Atf E ,d' E )e-t TB ^ + * T ° r ^ d \ (51) 
Using the cyclic property of the trace, we get 

tr(v^p°v^) = tr (pip ) = e -24 T 7;- i ^| 7 ^|-i/2 = 



A(^' E: d' E ). One then has 



C{i E )^A{i El d' E )e-t Tu ^+< T °<^ d ' E \ (52) 
which, after substitution, gives 

tr(^W^T) = e-< T ^ ld '-M{i E ) (53) 

However, note that if d' E = 0, po = Pii an d 

Vf>oPo>/Po) = 1- This implies that M{^' E ) = 1, 
and so: 

triy/y/HpoVfi) = e-^i* 1 ** (54) 
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